CVE-2024-50163

What it actually does

The bpf_redirect_info structure shares identical numeric flag values (BPF_F_BROADCAST == BPF_F_NEXTHOP) between SKB and XDP redirect paths, causing the XDP path to misinterpret flags set by skb bpf_redirect_neigh() and crash the kernel.

Why it matters to the business

Potential kernel crashes and service outages on Linux systems performing mixed BPF redirects; low exploitation probability and no known ransomware use reduce immediate risk, though kernel updates are required for long-term stability.

How an attack unfolds

An attacker uses a sequence of BPF operations that first invoke skb bpf_redirect_neigh with a non-NULL params argument and then perform an XDP redirect against the same bpf_redirect_info struct, triggering flag overlap and a crash; the issue was originally found via syzbot fuzzing.

How to fix it

Apply the upstream fix that moves flag definitions, redefines BPF_F_REDIRECT_INTERNAL to avoid overlap, and adds BUILD_BUG_ON checks; for the listed firefox package on Ubuntu 14.04 LTS upgrade to version 43.0+build1-0ubuntu0.14.04.1.

How to confirm the fix worked

Confirm the kernel contains the BUILD_BUG_ON() assertion for flag non-overlap and test mixed SKB/XDP redirect scenarios; verify package version matches the fixed firefox release on Ubuntu 14.04 LTS.

Typical attack path

1. Invoke skb bpf_redirect_neigh() with non-NULL params to set flags in bpf_redirect_info
2. Subsequently trigger an XDP redirect using the same struct
3. Exploit overlapping flag values to confuse the XDP path and induce a kernel crash

How to detect it

Review kernel logs for crashes involving bpf_redirect paths and inspect BPF program usage of redirect helpers; no widespread exploitation reported so focus on post-update verification.

What your security team should do

• Prioritize kernel updates on all systems using BPF redirects
• Monitor EPSS and threat actor activity for any increase in exploitation attempts
• Test the patch in staging environments before broad deployment